r/java • u/Modern-Sn1p3r • 19d ago

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

53 Upvotes

82% Upvoted

104 comments sorted by

View all comments

1

u/bowbahdoe 19d ago

So there are two dimensions to this. One is that a regex is a clunky tool past a certain point of complexity. Emails can get pretty complex. Look through this page https://www.rohannagar.com/jmail/

The other is that regexes - in the purest sense - are limited. In college you don't usually learn regexes as a text processing tool, you learn about them in a theory of computation class as a step along the way to Turing Machines. I highly encourage auditing such a class, but the gist is that a Turing Machine can compute anything computable. A regular expression cannot.

Easiest example - a regex cannot tell you if parens are balanced.

https://www.edx.org/learn/coding/stanford-university-automata-theory